Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'STARTUP' = 'C:\GatonFiles\Scirpts\Actualizador.vbs'
Изменения в файловой системе
Создает следующие файлы
- C:\gatonfiles\scirpts\regedit.vbs
- C:\temp\files\cmc.bat
- C:\temp\files\despiertador.bat
- C:\temp\files\despiertador.vbs
- C:\temp\files\files.vbs
- C:\temp\files\messagesender.vbs
- C:\temp\files\regedit.vbs
- C:\temp\files\wifi.bat
- C:\temp\files\uploader.bat
- C:\temp\files\despiertadorrapido.vbs
- C:\temp\files\despiertadorrapido.bat
- C:\temp\files\despiertadespiertador.vbs
- C:\temp\files\despiertadespiertador.bat
- C:\temp\files\actualizador.vbs
- C:\temp\files\link.exe
- C:\gatonfiles\scirpts\mortu.vbs
- C:\temp\files\userdata.bat
- C:\gatonfiles\scirpts\mortu.bat
- C:\gatonfiles\scirpts\wifi.bat
- C:\gatonfiles\scirpts\uploader.bat
- C:\gatonfiles\scirpts\messagesender.vbs
- C:\gatonfiles\scirpts\userdata.bat
- C:\gatonfiles\scirpts\despiertadorrapido.bat
- C:\gatonfiles\scirpts\files.vbs
- C:\gatonfiles\scirpts\link.exe
- C:\gatonfiles\scirpts\despiertador.bat
- C:\gatonfiles\scirpts\actualizador.vbs
- C:\gatonfiles\scirpts\cmc.bat
- C:\gatonfiles\scirpts\despiertador.vbs
- C:\gatonfiles\scirpts\despiertadorrapido.vbs
- C:\gatonfiles\scirpts\despiertadespiertador.bat
- C:\gatonfiles\scirpts\despiertadespiertador.vbs
- C:\gatonfiles\scirpts\uploader.vbs
- C:\gatonfiles\scirpts\morto.bat
- C:\temp\files\uploader.vbs
Присваивает атрибут 'скрытый' для следующих файлов
- C:\gatonfiles\scirpts\regedit.vbs
- C:\gatonfiles\scirpts\morto.bat
- C:\gatonfiles\scirpts\actualizador.vbs
- C:\gatonfiles\scirpts\uploader.vbs
- C:\gatonfiles\scirpts\despiertadespiertador.vbs
- C:\gatonfiles\scirpts\despiertadespiertador.bat
- C:\gatonfiles\scirpts\despiertadorrapido.vbs
- C:\gatonfiles\scirpts\despiertador.vbs
- C:\gatonfiles\scirpts\mortu.bat
- C:\gatonfiles\scirpts\cmc.bat
- C:\gatonfiles\scirpts\wifi.bat
- C:\gatonfiles\scirpts\link.exe
- C:\gatonfiles\scirpts\files.vbs
- C:\gatonfiles\scirpts\despiertadorrapido.bat
- C:\gatonfiles\scirpts\userdata.bat
- C:\gatonfiles\scirpts\messagesender.vbs
- C:\gatonfiles\scirpts\uploader.bat
- C:\gatonfiles\scirpts\despiertador.bat
- C:\gatonfiles\scirpts\mortu.vbs
Удаляет следующие файлы
- C:\gatonfiles\scirpts\morto.bat
Сетевая активность
TCP
Запросы HTTP GET
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK microsoft.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\DespiertadorRapido.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\Mortu.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\Files.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\Messagesender.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\Regedit.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\Despiertador.vbs" param1
- '%WINDIR%\syswow64\wscript.exe' "C:\GatonFiles\Scirpts\DespiertaDespiertador.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\cmc.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Uploader.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\DespiertaDespiertador.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v reco /f"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Mortu.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v nes /f"' (со скрытым окном)
- '%WINDIR%\syswow64\ping.exe' -n 1 -w 300 1.1.1.1' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v fea /f"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\DespiertadorRapido.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\UserData.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Despiertador.bat" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\DespiertadorRapido.bat" "
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get name
- '%WINDIR%\syswow64\cmd.exe' /c curl "https://wttr.in/?format=%c"
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get CurrentClockSpeed
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get CurrentClockSpeed
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get NumberOfCores
- '%WINDIR%\syswow64\timeout.exe' 5
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get NumberOfCores
- '%WINDIR%\syswow64\timeout.exe' /t 3 /Nobreak
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_VideoController get name
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get name
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_VideoController get CurrentRefreshRate
- '%WINDIR%\syswow64\timeout.exe' /t 5 /NOBREAK
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get name
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get CurrentRefreshRate
- '%WINDIR%\syswow64\timeout.exe' /t 10 /NOBREAK
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_VideoController get VideoModeDescription
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get VideoModeDescription
- '%WINDIR%\syswow64\cmd.exe' /c wmic baseboard get product
- '%WINDIR%\syswow64\wbem\wmic.exe' baseboard get product
- '%WINDIR%\syswow64\cmd.exe' /c wmic OS GET Caption
- '%WINDIR%\syswow64\wbem\wmic.exe' OS GET Caption
- '%WINDIR%\syswow64\cmd.exe' /c wmic OS GET CSName
- '%WINDIR%\syswow64\wbem\wmic.exe' OS GET CSName
- '%WINDIR%\syswow64\cmd.exe' /c wmic OS GET Version
- '%WINDIR%\syswow64\wbem\wmic.exe' OS GET Version
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_VideoController get DriverVersion
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get DriverVersion
- '%WINDIR%\syswow64\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Files.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine,ProcessId /format:value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Files.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine,ProcessId /format:value
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get FreePhysicalMemory
- '%WINDIR%\syswow64\timeout.exe' 70 /nobreak
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='wscript.exe'" get ParentProcessID
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='wscript.exe'" get ParentProcessID
- '%WINDIR%\syswow64\timeout.exe' 1 /nobreak
- '%WINDIR%\syswow64\ping.exe' -n 1 -w 300 1.1.1.1
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v fea /f"
- '%WINDIR%\syswow64\timeout.exe' 3 /nobreak
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v nes /f"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Uploader.bat" "
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v reco /f"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\DespiertaDespiertador.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\UserData.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Mortu.bat" "
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Despiertador.bat%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId / format:value
- '%WINDIR%\syswow64\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Despiertador.bat%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId / format:value
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\cmc.bat" "
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles
- '%WINDIR%\syswow64\findstr.exe' /R /C:"[ ]:[ ]"
- '%WINDIR%\syswow64\wbem\wmic.exe' process where name="wscript.exe" call setpriority 16384
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\GatonFiles\Scirpts\Despiertador.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Regedit.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId / format:value
- '%WINDIR%\syswow64\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Regedit.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId / format:value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Messagesender.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine,ProcessId /format:value
- '%WINDIR%\syswow64\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scirpts\\Messagesender.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine,ProcessId /format:value
- '%WINDIR%\syswow64\cmd.exe' /c wmic OS get FreePhysicalMemory
- '%WINDIR%\syswow64\cmd.exe' /c curl "https://myexternalip.com/raw"
- '%WINDIR%\syswow64\cmd.exe' /c wmic OS GET OSArchitecture
- '%WINDIR%\syswow64\wbem\wmic.exe' OS GET OSArchitecture
